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A method and device for monitoring signal processing units for sensors 

BACKGROUND OF THE INVENTION 

[0001] The invention relates to a method and a device for monitoring signal processing 
units for sensors which detect the individual process control quantities or process meas- 
ured values of a process. 

[0002] Electronic stability programs are driving dynamics control systems for vehicles that 
serve to support the driver in critical driving situations during braking, accelerating and 
steering, and to intervene in cases where the driver himself has no possibility of interven- 
ing directly. The control system supports the driver during braking, particularly on a 
roadway with a low or changing friction value, on which the vehicle can no longer be con- 
trolled because of locking wheels, or could begin skidding upon accelerating, whereby 
there is a danger of the drive wheels spinning, as well as, finally, during steering on a 
curve during which the vehicle could oversteer or understeer. On the whole, not only the 
comfort, but also the active safety, is thereby significantly improved. The basis for such a 
control system is formed by a closed control circuit which, during the normal operation of 
the vehicle, assumes typical control tasks and, during extreme driving situations, is in- 
tended to catch the vehicle as quickly as possible. Sensors for the determination of the 
different driving dynamics parameters are, as the actual value transmitters, thereby par- 
ticularly important. A plausible control presupposes that the sensors correctly reproduce 
the actual condition of the control system interval. This is particularly important during 
driving stability control actions in extreme driving situations, in which a deviation from 
control must be fully stabilized within a very short time. For this reason, the sensors in an 
electronic stability program (yaw rate sensor, lateral acceleration sensor, and steering 
angle sensor) must be monitored continuously. A corresponding online-sensor monitor- 
ing has the purpose of detecting errors in the sensors at an early stage, so that an error 
in control that could bring the vehicle into a safety-critical condition is ruled out. 
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[0003] The ESP systems that are in serial production at the present time use a multiple 
sensor ("sensor cluster") for the determination of the rotational rate of the vehicle, as well 
as of the lateral and the longitudinal acceleration, if necessary. This sensor is placed in 
the passenger space and communicates with the ESP control device by way of a CAN 
interface (WO 99/47889). 

[0004] Future applications (such as the ESP 2 or active front steering AFS, for example) 
even use the signals of the sensor cluster to influence the steering. Since steering inter- 
ventions entail significantly higher risks than braking interventions, greater demands are 
also placed on the reliability of the sensing technology. Redundant systems, which can 
recognize error functions independently and react correspondingly, are required. 

[0005] Figure 1 depicts a known sensor cluster in a redundant design. The rotation rate 
sensor (11, 12) and the acceleration sensor (1, 2) are thus present twice. The signal 
processing is carried out in a commonly used set of chips. The A/D transformers (ADC 1 
and ADC 2) and the processor core (//CI, //C2) are thereby designed redundantly, while 
the signal paths (13, 14) (such as the SPI interface between the transformers and proc- 
essors, reception register, etc., for example) are only present once, however. Defective 
sensor elements, as well as errors in the program design, can thus be detected. 

[0006] It is disadvantageous, however, that errors are not detected on the transmission 
path between the A/D transformer (ADC) and the processor, just as errors in the A/D 
transformer itself (such as partial bits, for example), which lie within the order of magni- 
tude of the permissible signaling precision, are also not detected. 

[0007] The task that forms the basis for the invention is thus that of creating a method 
and a device for monitoring the signal processing of sensors of the type stated above 
that has the reliability that is necessary, particularly for driving stability control and/or 
comfort control during active steering interventions for vehicles. 
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SUMMARY OF THE INVENTION 

[0008] This task is solved by means of a method of the type stated above, which is char- 
acterized by an at least redundant processing of the sensor data in two identical signal 
processing units, which are each evaluated and checked for plausibility, independently 
and separately from one another, by means of at least two processing devices in two 
evaluation devices, whereby the sensor data are transmitted between the one processing 
device and the one evaluation device through separate signal lines. 

[0009] It is advantageous that, in every evaluation device sensor, the data that are sepa- 
rately evaluated and checked for plausibility are exchanged by way of an interface be- 
tween the evaluation devices. The sensor data and the condition information of the spe- 
cific other evaluation unit that have been evaluated and checked for plausibility are 
thereby sent to a superordinate control device of the vehicle by each evaluation device, 
independently of the other one. 

[0010] The transmission of the sensor data and the condition information that have been 
evaluated and checked for plausibility to the other evaluation unit is carried out, by way of 
internally separate signal lines, to one data bus and the control device of the vehicle. 

[0011] This task is additionally solved with a device of the type stated above, which is 
characterized by at least two identical signal processing units for the redundant process- 
ing of the sensor data, with at least two processing devices and two evaluation devices, 
in which the sensor data are evaluated and checked for plausibility independently of and 
separately from one another, whereby one processing device is connected with the one 
evaluation device by way of separate signal lines, and the sensor data are transmitted 
between the one processing device and the one evaluation device by way of the sepa- 
rate signal line. 

[0012] The following advantages result from the invention; 
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• Completely redundant signal path all the way to the signal output. All errors ap- 
pearing in the system can be detected. 

• Prevention of a loss of comfort from a premature system activation caused by er- 
rors that are still within the framework of the range specified. 

• Suitability for highly sensitive systems with very low control thresholds. 

• Cost savings through the use of components identical to the non-redundant stan- 
dard sensor cluster. No special components (such as double core processors, for 
example) are necessary. 

[0013] Examples of implementation of the invention are depicted in the diagrams, and 
are described in further detail in the following. 

BRIEF DESCRIPTION OF THE DRAWINGS 

[0014] These depict the following: 

[0015] Figure 1: A simple redundant sensor cluster in accordance with the 
state of the art; 

[0016] Figure 2: A schematic representation of the structure of an ESP sys- 
tem; 

[0017] Figure 3: A completely redundant sensor cluster in accordance with the 
invention. 

DETAILED DESCRIPTION OF THE DRAWINGS 
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[001 8] The process of auto driving can be considered, in accordance with Figure 2, in a 
technical control sense, as a control circuit in which a driver (1) represents the control 
unit, and a vehicle (2) represents the control system. The control inputs are thereby the 
personal driving wish (FW) of the driver, which he determines through the continuous 
observation of the road traffic. The actual values (IF) are the current values for the direc- 
tion and speed of travel, which the driver determines by means of his sight or driving 
sensations, as the case may be. The control variables (SF) are, finally, the steering 
wheel angle, the position of the transmission, as well as the positions of the gas and 
brake pedals, which are determined by the driver on the basis of the deviations between 
the theoretical and the actual values. 

[0019] Such a type of control is frequently made more difficult by disturbances (S), such 
as changes in friction values, irregularities in the roadway, lateral wind, or other influ- 
ences, since the driver cannot precisely detect these, but still must take them into con- 
sideration during the control, however. For this reason, the driver (1) can, to be sure, 
generally manage the tasks conveyed to him - that is to say, controlling and observing 
the process of driving the auto under normal driving conditions ~ on the basis of his train- 
ing and accumulated experience without difficulties. Under extreme situations and/or un- 
der the extraordinary driving conditions noted, under which the physical friction bounda- 
ries between the roadway and the tires are exceeded, the danger does exist, however, 
that the driver will react too late, or incorrectly, and will lose control of his vehicle. 

[0020] In order to be able to take even these driving situations into account, the driving 
dynamics control system is supplemented by a subordinate control circuit (ESP) which, in 
accordance with Figure 1, comprises a control algorithm (4). a system monitoring unit (5), 
and an error memory (6). Measured driving condition values are thereby transmitted to 
the system monitoring unit (5) and to the control algorithm (4). The system monitoring 
unit (5) produces an error message (F), if necessary, which is transmitted to the error 
memory (6) and to the control algorithm (4). The control algorithm (4) then acts on the 
vehicle (2) in dependence on the control variables produced by the driver (1). Typical 
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control tasks are carried out with this control circuit. Under extreme driving situations, the 
vehicle can be caught again as quickly as possible. 

[0021] Figure 3 depicts the structure of such a control circuit, which essentially comprises 
an anti-blocking system (10), a drive skidding control (11), and a yaw momentum control 
(12). The system can be supplemented by a steering angle control not depicted in further 
detail, such as is described in WO 2004/005093, for example. In addition, yaw rate sen- 
sors (13), lateral acceleration sensors (14), a steering angle sensor (15), a pressure sen- 
sor (16), and four wheel speed sensors (17) are provided, which are used both as actual 
value transmitters for the determination of the control deviation, as well as for the forma- 
tion of a yaw rate theoretical value and various intermediate values. 

[0022] The process control inputs produced by the driver (1) through the activation of the 
gas and brake pedal, as well as the steering wheel, are added to the drive skidding con- 
trol (11), the anti-blocking system (10), and the pressure sensor (16), as well as the 
steering angle sensor (15), as the case may be. Vehicle-specific non-linearities, fluctua- 
tions of the friction values, lateral wind influences, etc., are summarized as disturbances 
or unknown values (18) and influence the longitudinal and lateral dynamics of the vehicle 
(19). This dynamic (19) is, furthermore, influenced by the control inputs noted, as well as 
by the output signals of an engine management unit (20), and acts on the wheel speed 
sensors (17), the yaw rate sensors (13), the lateral acceleration sensors (14), as well as 
the pressure sensor (16). A control arbitration unit (21), to which the output signals of the 
anti-blocking system (10), the drive skidding control (11), the yaw momentum control 
(12), the steering angle control, and a braking intervention algorithm (22) are transmitted, 
serves for the distribution of priorities to these signals in relation to their effect on the en- 
gine management unit (20), or directly on the driving dynamics (19). The braking inter- 
vention algorithm (22) is thereby influenced by the yaw momentum control (12) and the 
pressure sensor (16). Finally, a driving condition detection unit (23) is provided, to which 
the signals of the steering angle sensor (15), the yaw rate sensors (13), the lateral accel- 
eration sensors (14), as well as the wheel speed sensors (17) are transmitted, and the 
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output signals of which influence the yaw momentum control (12) as well as a single- 
track reference model (24), by means of which a theoretical yaw rate desired or the 
steering angle is produced. 

[0023] The sensor cluster (40), with a completely symmetrical redundancy of the signal 
processing units (43, 31. 46 and 44, 32, 45). is depicted in Figure 4. The sensor cluster 
(40) consists of two identical separate paths for the signal processing. The rotation rate 
sensor (41, 42) and the acceleration sensor (21, 22) are present twice. The sensors (41, 
42, 21, 22) and the signal processing units (43, 31, 46 and 44. 32. 45) are preferably po- 
sitioned in a common casing (62). Two signal processing devices (43, 44), such as an 
analogue-digital signal transformer, which convert the analogue output signal of the sen- 
sors into a digital input signal, are assigned to them. Two evaluation devices (31, 32), 
such as identical microcontrollers, digital signal processors (DSP), or programmable logic 
modules, particularly ASIC's, are used for the signal processing. The sensor data are 
transmitted between the one processing device (43, 44) and the one evaluation device 
(31, 32) by way of a separate signal line (60, 61). The signals, which are now present in 
digital form, are processed in the evaluation devices (31, 32) in digital form. The evalua- 
tion-related sensor signals are applied to the output side of the evaluation devices (31, 
32). These are supplied to the serial vehicle communication bus (47) by way of the two 
CAN controllers (45, 46) provided in the evaluating devices (31, 32). The evaluation de- 
vices (31, 32), which are connected with the integrated CAN (controller area network) by 
way of the separate lines (71 , 72), thereby assume the following system functions: 

• Preparation of a driver signal / driver voltage for the activation of the electrical- 
mechanical transformer of the rotation rate sensor (41, 42). 

• Reception of the signals of the rotation rate sensor (41, 42) with specific algo- 
rithmic allocations and filtering in order to obtain a numerical value for the yaw 
movement of a vehicle. 
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• Conversion of the numerical values of the yaw movement of a vehicle into the 
CAN and transfer to the serial bus (47). 

[0024] These evaluation devices (31, 32) can correspond precisely to the components 
used in the known sensor cluster (such as EP 1 064 520 B1, for example) - that is to 
say, no special components are then needed for this system. 

[0025] The outputs of both of the signal processing units (43, 31, 46; 44, 32, 45) can be 
joined in the sensor cluster (40), or else they can be connected, in separate lines (49, 
50), with the vehicle communication bus (here: CAN). In the event of a joining in the sen- 
sor cluster, the interface remains compatible with the existing system. 

[0026] Each of the evaluation devices (31, 32) has access to all of the sensor data, and 
carries out a signal processing and plausibility evaluation independently of the others. It 
reports the result of its plausibility evaluation and of its computations, if applicable, to its 
partner by way of an appropriate interface (48). 

[0027] Each of the evaluation devices (31, 32) thereupon sends a communication (here: 
CAN message) to the (ESP) control device independently of the others. This communi- 
cation contains, in coded form, the specific data, the status of its own plausibility evalua- 
tion, as well as the condition signaled by the partner. 

[0028] The control device decides, in dependence on the status flags contained in the 
communications, whether the data are to be evaluated as valid, as conditionally valid, or 
as incorrect. Conditionally valid data can be evaluated through comparison with other 
values, such as with the wheel speeds, for example, by means of the model: 
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- and are additionally used, if necessary. (S) is hereby the lane width of the vehicle, (Vvr) 
is the wheel speed, front right, and (Vvi) is the wheel speed, front left. Thus, in the event 
of a failure of a yaw rate signal, such as during an ESP control of the control device, for 
example, the intact signal can be identified and used to continue the control by means of 
the available model data. 

[0029] In terms of expense, this solution corresponds to two separate identical sensor 
clusters. It has the advantage, however, that each cluster can have access to the sens- 
ing technology of the other one. Additional information is made available by this means. 

[0030] The redundancy concept illustrated here in the example of a sensor cluster can be 
applied to any other sensor systems desired. Thus, the following variations, which are 
jointly included in the invention, are conceivable: 

• The use of n > 2 signal processing units (43, 31, 46), which access the signals of 
any desired number of sensors (41, 42, 21, 22), a portion of which may be redun- 
dantly present, but which do not have to be, however. 

• Redundant sensors (41, 42) may be present in double form or in multiple form (> 
2). With three or more sensors, a decision can be made as to which sensor is de- 
fective, even during the signal processing. 

• The sensors (41. 42, 21, 22) and the signal processing units (43, 31, 46; 44, 32, 
45) do not have to be located in the same casing (62). 

• The connection (63-70) of the sensors to the signal processing units may be car- 
ried out by analogue or digital means. 

• The connection of the signal processing units (43, 31, 46; 44, 32. 45) to the su- 
perordinate control device may be carried out by analogue or digital means. 
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• The signal processing units (43, 31, 46; 44, 32, 45) exchange status information, 
computation results, or even no information at all. 

• The signal processing units (43, 31 , 46; 44, 32, 45) can carry out different tasks at 
different times (such as during the initialization phase or during self-diagnosis, for 
example). 

• Not every signal processing unit (43. 31, 46; 44, 32, 45) has to evaluate all sensor 
signals, but even partially redundant systems are possible. 

[0031] In the event that a superordinate system is not acceptable, there is the advanta- 
geous form of implementation of only allowing one signal processing unit (43, 31, 46; 44, 
32, 45) to communicate actively. The other one(s) initially remain(s) passively in the 
background, but nevertheless carry out the checking for plausibility with the correspond- 
ing internal communication, however. It is only if a discrepancy has been determined 
there that the passive signal processing units carry out a veto and actively report to the 
superordinate system. If realized in practical terms, this could appear as follows: 

The signal processing units (43, 31, 46) and (44, 32, 45) are identical, but have a 
software coded by means of a PIN number, however, which makes two types of 
operation possible. 

The signal processing unit (43, 31, 46) works as a master (coding 1) and sends 
the result of its evaluation to the CAN. 

[The] signal processing unit (44, 32, 45) works as a slave (coding 0) and com- 
pares the result of the master received through the CAN with its own computa- 
tions. It reports an agreement or a deviation, as the case may be, to the master, 
and sends a CAN message to the system with an error flag set, if necessary. 
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The communication can take place by way of two lines, MATCH, MATCH_N, for 
example, which toggle in an opposite manner in every software loop and, in the 
event of errors, either both go to 1 or both go to 0. 

The signal processing unit (43, 31, 46) recognizes, through the acknowledgement 
noted above, that the signal processing unit (44, 32, 45) is available and is work- 
ing. 

The signal processing unit (44, 32, 45) recognizes, through the receipt of the CAN 
messages, that the signal processing unit (43, 31, 46) is available and is working. 
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